I was thinking on a way similar to robots.txt that is used by good bots crawling a website. In the robots.txt I can define the User-agent, Allow and Disallow.
My goal is to pass the message about the request rate limiting to the bots also, saying for example that they are not allowed to go over xxx requests per second, minute, etc.
I know how to put a hard limit in place, but the goal hire is not to block them.
I have one file called test1.xml withe the following content:
Hello how are you doing?
And am trying to apply the following sed search and replace:
sed -i 's/Hello //g' test1.xml
And the file remains the same!!!
I am copying the content of that same file to a new file I name test2.xml, apply the same sed and it works, Hello gets removed. Any idea?
I'm on OSX BigSur 11.5.2.
Here are the two files: test1.xml: https://we.tl/t-tX1SMdYQ0A test2.xml: https://we.tl/t-AULhYhZ2K9
When checking both files, it looks like they are different:
od -c test1.xml
0000000 376 377 \0 H \0 e \0 l \0 l \0 o \0 \0 h
0000020 \0 o \0 w \0 \0 a \0 r \0 e \0 \0 y
0000040 \0 o \0 u \0 \0 d \0 o \0 i \0 n \0 g
0000060 \0 ?
0000062
od -c test2.xml
0000000 H e l l o h o w a r e y o
0000020 u d o i n g ?
0000030
On Ubuntu 16.04 and 18.04 servers, in the /var/log/syslog file, there are often Martian source messages like:
Aug 23 06:42:51 scilit-solr kernel: [5417098.171549] IPv4: martian source 255.255.255.255 from 192.168.0.239, on dev bond0
Aug 23 06:42:51 scilit-solr kernel: [5417098.171565] ll header: 00000000: ff ff ff ff ff ff 00 8e f2 4e 0e 67 08 00 .........N.g..
How to find out who is trying to communicate on an subnet? I tried to run:
sudo tcpdump -i bond0 host 192.168.0.239
And got this:
06:46:41.750645 ARP, Request who-has 192.168.0.239 tell 192.168.0.239, length 46
06:46:41.750790 ARP, Request who-has 192.168.0.239 tell 192.168.0.239, length 46
06:46:41.754853 ARP, Request who-has 192.168.0.239 tell 192.168.0.239, length 46
06:46:41.754981 ARP, Request who-has 192.168.0.239 tell 192.168.0.239, length 46
06:46:41.759720 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:46:41.759865 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:46:46.081698 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:46:46.081836 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:46:52.414603 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:46:52.414749 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:47:03.750032 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:47:03.750170 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:47:26.089927 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
06:47:26.090082 IP 192.168.0.239.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:8e:f2:4e:0e:67 (oui Unknown), length 253
The goal would be to identify the device who often sends the who-has and fix it's IP and subnet.
We have a zimbra email server and one of the email accounts was compromised. The problem we have now is that a lot of spams are sent from that server and we cannot identify which account is compromised.
In the mailq we can only see the from email, but this is a fake email address.
Is there a way to identify the real auth user who is sending those emails?
We recently did a migration from MySQL 5.5 to MySQL 5.7, on two different servers. For the migration, we used a master-slave replication. The old DB (5.5) was set as master, the new one as slave (5.7).
Everything went well and the migration was successful. The DB is large, about 600G of data.
The problem we have now is that on the new DB, ther is one large .ibd file of 82G. Let's asume the DB name is my_database. This file is located under: /var/lib/mysql/my_database:
-rw-r----- 1 mysql mysql 82G Apr 20 10:28 articles.ibd
The articles table is big, but why there is such large ibd file on the new MySQL server, and was not there on the old one.
As we have now some storage limits (SSD), we would like to somehow delete this file. How to do it and why this file is created there on MySQL5.7?
As far as we checked, this is due to the https://dev.mysql.com/doc/refman/5.7/en/innodb-multiple-tablespaces.html, but is it safe disable this option with SET GLOBAL innodb_file_per_table = OFF; remove the .ibd files and restart MySQL?
We have an Lenovo server working well since one and a half year. Sudenly, we started having issues to connect to it from our office network. I reinstalled ubuntu 16.04 sever on it. It has two ethernet ports, one used for the public ip and another for the internal network.
When trying to connect with a mobile network or one specific server from our local office network, all works well, but as soon as I am trying to connect to it from my or my colleagues local PCs, or another office server, I am getting a timeout, both on ssh port, 80, 443 etc.
The server side has a firewall, but that's not the issue as from the same network, the connection works from some machines, but not from others?
Thank you.
I am trying to rsync some backup files from a ubuntu server into a mounted NAS.
All works well except for a big 13GB gz file which shows this error:
rsync: close failed on "/mnt/backupnas/chbsl018/.chbslds018-OALit_db.gz.6L8sHs": Input/output error (5)
rsync error: error in file IO (code 11) at receiver.c(856) [receiver=3.1.0]
The original 13 GB file is called chbslds018-OALit_db.gz and is a gzipped sql file.
The rsync command called is:
rsync -avz -c -h -H --delete --stats /data/backups/backup_db/ /mnt/backupnas/backup_db/
Any idea why I am getting this error?
Update:
In the syslog, I can find this:
Nov 17 17:16:11 backup kernel: [4089920.125948] CIFS VFS: Server 172.16.0.16: has not responded in 120 seconds. Reconnecting...
Nov 17 17:17:01 backup CRON[13015]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
Nov 17 17:18:35 backup kernel: [4090064.643918] CIFS VFS: Server 172.16.0.16: has not responded in 120 seconds. Reconnecting...
Nov 17 17:23:40 backup kernel: [4090369.179512] CIFS VFS: SMB response too short (0 bytes)
Nov 17 17:28:21 backup kernel: [4090650.480562] CIFS VFS: Server 172.16.0.16: has not responded in 120 seconds. Reconnecting...
I am using Ubuntu Server 14.04 LTS and tryng to change Nginx ssl_protocols to
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
I restarted nginx and php5-fpm.
When checking the enabled protocols on www.ssllabs.com, I still have TLSv1.1 TLSv1.2 only.
I tried to also comment this ssl_protocols line or leave TLSv1.2 only, but it doesn't seems to change anything. The GeoTrust website shows the same thing.
Which service do I need to restart in addition in order to be able to change the ssl_protocols in Nginx?
Thank you.
I have an .lnx file that I need to use on the RedHat distribution. Any idea how to run / install it?
I tryed to make it executable and jut call it but this doesn't work.
Thank you.
In my process list with "top" command, I am getting a lot of php-fpm processes. Is there a possibility to get more info on that porcesses like:
I have an nginx server running that has multiple projects inside the sites-enabled. The problem comes when trying to access and nonexistent project url, nginx will render the 1st available.
Example, I have a server with the IP 111.222.333.444 and NGINX with those projects:
I am creating now a new domain that is ddd.test.com and points to the 111.222.333.444 When trying to access ddd.test.com, my browser will open aaa.test.com
Any idea why?
In my nginx project config I have for aaa.test.com
server {
listen 80;
server_name aaa.test.com;
access_log /usr/local/nginx/logs/aaa.access.log;
error_log /usr/local/nginx/logs/aaa.error.log;
root /var/www/aaa/web;
client_max_body_size 60M;
location / {
index app.php;
if (-f $request_filename) {
break;
}
rewrite ^(.*)$ /app.php last;
}
## Parse all .php file in the /var/www directory
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_pass 127.0.0.1:9001;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $request_filename;
include fastcgi_params;
}
}
I have an iptables rule. When searching for it with
sudo /sbin/iptables -L -n --line-numbers
I am getting it
Chain tcp_inbound (1 references)
num target prot opt source destination
xxxx
2 ACCEPT tcp -- 10.10.0.20 0.0.0.0/0 tcp dpt:25
xxxx
...
My goal is to delete this rule.
I tried with
sudo iptables -D INPUT 2
But the rule is still there. I am on debian. Any idea?
I have MySQL running on my Ubuntu server and suddenly the MySQL Daemon was down. When trying to restart it, the restart failed due to
xxx table is marked as crashed and last (automatic ) repair failed
So then I have to truncate the table, restart MySQL and everything was fine. We had backups so we were able to recover.
Any idea why this happens and how to check what caused this?
I have a SMTP server named smtp-ca.mdpi.com and when sending emails to some specific chinese email domains, I am getting back:
550 Requested mail action not taken: Invalid IP<64.15.147.140> (in reply to end of DATA command))
I have an SPF set in the TXT of the domain. The rDSN is working fine.
Any idea why this happens?
Thank you in advance.
EDIT: Here is the postconf -n configuration
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
inet_interfaces = 127.0.0.1 10.10.0.10
local_transport = error:local delivery is disabled
mailbox_size_limit = 0
message_size_limit = 102400000
myhostname = smtp-ca.mdpi.com
mynetworks = 127.0.0.0/8 10.10.0.0/24
myorigin = /etc/mailname
readme_directory = no
sender_canonical_maps = hash:/etc/postfix/sender_canonical
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_client_restrictions = permit_mynetworks, reject
virtual_alias_maps = hash:/etc/postfix/virtual_aliases
On one of the servers, I have mysqld running as slave DB.
The CPU usage is 175% at the moment used by mysqld.
Here are the results of SHOW PROCESSLIST;
+----------+-------------+-----------+---------+---------+---------+-----------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------+
| Id | User | Host | db | Command | Time | State | Info |
+----------+-------------+-----------+---------+---------+---------+-----------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------+
| 109029 | system user | | NULL | Connect | 2346123 | Waiting for master to send event | NULL |
| 109030 | system user | | NULL | Connect | 0 | Slave has read all relay log; waiting for the slave I/O thread to update it | NULL |
| 12944426 | root | localhost | NULL | Query | 0 | NULL | SHOW PROCESSLIST |
| 12944443 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944445 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944463 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944466 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944467 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944469 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944470 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944471 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944476 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944479 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944482 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944484 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944485 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944488 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944490 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944491 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944492 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944493 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944495 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944496 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944498 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944499 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944501 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944502 | mdpipub | localhost | mdpipub | Query | 0 | Sending data | SELECT DISTINCT(article_id) FROM authors WHERE CONCAT(
firstname,
|
| 12944503 | mdpipub | localhost | mdpipub | Sleep | 0 | | NULL |
| 12944504 | mdpipub | localhost | mdpipub | Query | 0 | Sending data | SELECT DISTINCT(article_id) FROM authors WHERE CONCAT(
firstname,
|
+----------+-------------+-----------+---------+---------+---------+-----------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------+
I am using OpenVPN and am able to connect, but with no internet access anymore.
Here is my ip table:
sshadmin@mdpi1:/etc/openvpn/easy-rsa/keys$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 my.live.ip.adr 0.0.0.0 UG 0 0 0 eth0
my.live.ip.adr 0.0.0.0 255.255.255.224 U 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.10.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
Here is the server configuration:
### General config
dev tun
proto udp
port 1194
client-to-client
### Certificates
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
### User permissions
user nobody
group nogroup
### VPN network subnet
server 10.8.0.0 255.255.255.0
### Varia
keepalive 10 120
persist-key
persist-tun
### Logging
status /var/log/openvpn-status.log
verb 3
log-append /var/log/openvpn
### Push network config (default gateway and DNS server)
push "redirect-gateway local def1"
push "dhcp-option DNS 10.8.0.1"
### User authentication settings
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login
client-cert-not-required
username-as-common-name
### Management interface
management localhost 7505
Any idea why there is a problem?
Thank you.
I want to change the MySQL DB password on the master db. My question is: do we have to care for the slave DB when changing the master database password?
I installed openVPN on my server. By default, the port 1194 is choosen.
The problem is that when I am running:
sudo nmap -sU localhost -p 1194
It shows me:
PORT STATE SERVICE
1194/udp closed openvpn
I was trying to:
sudo /sbin/iptables -I INPUT -p udp -m udp --dport 1194 -j ACCEPT
By running
sudo netstat -uapn | grep openvpn
I am getting:
udp 0 0 172.16.0.5:1194 0.0.0.0:* 6788/openvpn
But nothing changed. Any idea?
I have a web application which is processing some data on server side. I am requesting this process with a post request.
The problem is that if I have a big amount of data, I will get a timeout. I am usig a ngnix server with PHP.
The error I am getting is 404 Not Found.
Do you know how is it possible to increase the timeout?
Thank you.
I have a lot of subdomains in the main domain xxx.zzz
So, for this domain, I can have
aaa.xxx.zzz
bbb.xxx.zzz
ccc.xxx.zzz
ddd.xxx.zzz
eee.xxx.zzz
....ETC....
Istead of adding each subdomain in the host file, I would like to add only the main domain xxx.zzz and then to be able to access all the subdomains.
I have tryed with *.xxx.zzz but apparently, this will not work (Linux or Windows).
Any idea is welcome. Thank you very much.